CVE-2014-125135— OctoPrint Flask Secret Key hard-coded key
Quick assessment
Affected
n/a OctoPrint
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 OctoPrint 1.0.0 和 1.1.0 版本中发现了一个安全漏洞。受影响的是 Flask 密钥处理器（Flask Secret Key Handler）中的某个未知功能。该漏洞允许攻击者利用硬编码的加密密钥进行操纵，且攻击可从远程发起。升级到 1.11.1 版本可修复此问题，相关补丁的提交哈希为 b4699825d6ab92d5451e5b1e3a06dfb81f86e777。建议立即升级受影响的组件。
Possible ATT&CK Techniques 2 AI
T1552 · Unsecured Credentials T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2014-125135
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
OctoPrint Flask Secret Key hard-coded key
Source: CVE Program / CVE List V5
Vulnerability Description
A security vulnerability has been detected in OctoPrint 1.0.0/1.1.0. Affected is an unknown function of the component Flask Secret Key Handler. Such manipulation leads to use of hard-coded cryptographic key
. The attack may be performed from remote. Upgrading to version 1.11.1 is able to address this issue. The name of the patch is b4699825d6ab92d5451e5b1e3a06dfb81f86e777. The affected component should be upgraded.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
使用硬编码的密码学密钥
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| - | OctoPrint | 1.0.0 |
cpe:2.3:a:octoprint:octoprint:*:*:*:*:*:*:*:*
|
|
II. Public POCs for CVE-2014-125135
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2014-125135
请登录查看更多情报信息。
Vendor Pages for CVE-2014-125135 (1)
Other References for CVE-2014-125135 (5)
-
https://vuldb.com/cve/CVE-2014-125135 third-party-advisory
-
-
https://vuldb.com/submit/994545 third-party-advisory
Same Patch Batch · n/a · 2026-10-26 · 44 CVEs total
| CVE-2026-116106 | 7.3 HIGH | HeyCyan App FileProvider access control |
| CVE-2026-116253 | 7.3 HIGH | DedeCMS Advertisement Rendering ad_js.php _RunMagicQuotes code injection |
| CVE-2026-116257 | 7.3 HIGH | BillaBear Installation InstallController.php processInstall missing authentication |
| CVE-2026-116260 | 7.3 HIGH | libimobiledevice AFC Service afc.c service_receive double free |
| CVE-2026-116113 | 6.3 MEDIUM | GouGuOA Api.php chunkUpload unrestricted upload |
| CVE-2026-116258 | 6.3 MEDIUM | libimobiledevice AFC afc.c heap-based overflow |
| CVE-2026-116120 | 5.6 MEDIUM | NocoDB PublicApiLimiterGuard signup UserRefreshToken.deleteAllUserToken allocation of reso |
| CVE-2026-116119 | 5.5 MEDIUM | NocoDB Password-Reset Flow users.service.ts race condition |
| CVE-2026-116280 | 5.5 MEDIUM | Kameleo Proxy Validation f.cs InternalController.TestProxy server-side request forgery |
| CVE-2026-116262 | 5.4 MEDIUM | libimobiledevice Web Inspector webinspector.c webinspector_receive_with_timeout heap-based |
| CVE-2026-116259 | 5.3 MEDIUM | libimobiledevice Device Info afc.c afc_get_device_info_key memory corruption |
| CVE-2013-10077 | 5.3 MEDIUM | OctoPrint API Key settings.py getSettings information disclosure |
| CVE-2026-116274 | 4.3 MEDIUM | JIZHICMS Front-end Order OrderController.php pay improper authorization |
| CVE-2026-116282 | 4.3 MEDIUM | Kameleo Cookie Controller w.cs CookieController.ListCookies information disclosure |
| CVE-2026-116283 | 4.3 MEDIUM | Kameleo Local API profiles information disclosure |
| CVE-2026-116284 | 4.3 MEDIUM | Kameleo Local API user-info information disclosure |
| CVE-2026-116105 | 3.7 LOW | HeyCyan App Network Security Configuration AndroidManifest.xml cleartext transmission |
| CVE-2026-116121 | 3.7 LOW | NocoDB Registration users.service.ts race condition |
| CVE-2026-116123 | 3.7 LOW | NocoDB signup validatePassword excessive authentication |
| CVE-2026-116122 | 3.7 LOW | NocoDB Sign-in Endpoint AuthService.validateUser information disclosure |
Showing top 20 of 44 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: OctoPrint
-
CVE-2013-10077
OctoPrint API Key settings.py getSettings information disclo -
CVE-2026-54134
OctoPrint: File exfiltration possible via query parameters o -
CVE-2026-35163
OctoPrint: XSS in Suppressed Command Notifications -
CVE-2026-23892
OctoPrint has Timing Side-Channel Vulnerability in API Key A -
CVE-2025-64187
OctoPrint is vulnerable to XSS through Action Command Notifi
Same vendor: n/a
-
CVE-2026-116556
Argilla TextField.vue cross site scripting -
CVE-2026-116555
Argilla Sandbox.vue cross site scripting -
CVE-2026-116554
Argilla Settings SettingsInfo.vue Dataset.from_disk cross si -
CVE-2013-10077
OctoPrint API Key settings.py getSettings information disclo -
CVE-2026-116284
Kameleo Local API user-info information disclosure
Same weakness: CWE-321
-
CVE-2026-116747
Kener 3.0.0 before 4.1.10 Authentication Bypass via Hardcode -
CVE-2026-71456
Kantech Entrapass 9.20 前硬编码密钥漏洞 -
CVE-2026-112345
TTLock Android App < 9.8.260718 Hardcoded BLE Pairing Key Ex -
CVE-2026-110474
Hardcoded API Key Vulnerability in CreditNirvana Agentic AI -
CVE-2026-76298
Use of Hard-coded Cryptographic Key in the PostgreSQL Sideca